MITRE has released ATT&CK v20, expanding coverage across Enterprise and ICS with 15 new detection strategies and 38 analytics. In the Enterprise domain, the update adds several techniques and sub-techniques, including two variants of prompt injection—one for instructing a language model directly and another for instructions hidden in model input material.
Other additions describe attackers abusing an organisation’s own AI agents to exfiltrate data, poisoning web content to influence AI search and assistant results, and disrupting LLM-assisted malware analysis. A new technique covers theft of application-specific passwords used to sign in without an MFA prompt, and there are sub-techniques for bypassing CAPTCHA checks. The sub-technique for compromised software dependencies and development tools now includes IDE and coding agent configuration files. MITRE says these additions help capture how adversaries bypass Multi-Factor Authentication, bot checks, and AI systems.
In ICS, MITRE highlights two campaigns linked to water and wastewater utilities. The first tracks attacks on internet-exposed PLCs at more than 30 water and wastewater facilities in Minnesota, which reportedly left operators locked out; attribution to Iranian-affiliated activity remains unconfirmed. A second campaign documents an AI-assisted breach of Mexican government institutions that spanned IT and OT and impacted a municipal water utility.
Other ICS changes include the addition of the Command and Scripting Interpreter Technique with six interpreters, plus sub-techniques for DNS-based and publish/subscribe C2 traffic. New threat actors include Nimbus Manticore (IRGC-linked), Salt Typhoon’s edge-device exploitation, and APT38’s shift toward software supply chain attacks; The Gentlemen ransomware-as-a-service group is also newly noted. Mobile observations include delivery of malicious apps outside official stores and NGate malware that relays data via NFC to enable ATM cash withdrawals.